Microsoft365_devicePhish

Microsoft365devicePhish 滥用 Microsoft 365 OAuth 授权流程进行钓鱼攻击 这是一个简单的概念验证脚本，允许攻击者针对 Microsoft 365 OAuth 授权流程实施钓鱼攻击。利用此脚本，攻击者可连接 Microsoft 的 OAuth API 端点，生成 usercode 和 devicecode，并在成功的钓鱼攻击后获取受害用户的 accesstoken。随后，该令牌可用于通过 Microsoft Graph API 代表受害用户访问各种 Office365 产品。此外，此脚本专为解决特定场景而设计：目标组织使用邮箱...

squarephish

SquarePhish SquarePhish 是一款高级钓鱼工具，它结合了 OAuth 设备代码认证流程和二维码技术。 有关使用 OAuth 设备代码流程进行钓鱼攻击的更多详细信息，请参阅 PhishInSuits。 / | | | | | | | | | | | | | \ \ / | | | |/ | '/ \ /| ' | / | ' \ | | | || | | | | | / | | | | | \ \ | | | |/ , |,|,|| || || |||/| || | | || | | / | O |/ | |\ v0.1.0 || \ usage:...

squarephish

SquarePhish SquarePhish is an advanced phishing tool that uses a technique combining the OAuth Device code authentication flow and QR codes. See PhishInSuits for more details on using OAuth Device Code flow for phishing attacks. / | | | | | | | | | | | | | \ \ / | | | |/ | '/ \ /| ' | / | ' \ | |...

Microsoft Azure Entra ID OAuth Device Code Grant Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of Microsoft Azure. Authentication is not required to exploit this vulnerability. The specific flaw exists within the OAuth Device Code Grant endpoint. The issue results from the generation of...

CVE-2026-58122 Hermes WebUI < 0.51.307 Authentication Bypass via X-Forwarded-For Header Spoofing

Hermes WebUI before 0.51.307 contains an authentication bypass vulnerability that allows unauthenticated remote attackers to circumvent local-origin IP restrictions on onboarding endpoints by supplying a spoofed X-Forwarded-For header with a loopback address. Attackers can exploit this bypass to...

This Week in Spring - March 10th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring. As I write this, I am preparing for a trip to Rust, Germany, for one of the best Java conferences in Europe: JavaLand, along with its new companion event, DevLand. It should be fun. Will you be around? If so, say hi. We have ...

This Week in Spring - March 3rd, 2026

Hi Spring fans! Welcome to another rip-roaring installment of This Week in Spring! I'm writing this in an Uber en route to the airport to get to awsome Atlanta, GA, for Devnexus 2026! Who's goin'? You goin'? We - the Spring team - will be there in force! Come say hi at the boothes or come see our...